1. In a computer system including system memory, a method for providing 
information related to the termination of a process, the method comprising: 

an act of loading a termination function into system memory, the termination 
function having termination instructions that, when executed, cause a calling process 
to terminate without providing information related to a termination event that caused 
the calling process to terminate; 

an act of redirecting the functionality of the termination function to a memory 
resident detour function such that when the termination function is called instructions 
of the detour function are executed, the detour function having an invalid instruction 
that, when executed, causes an exception that can provide termination information 
related to a termination event that would otherwise cause a calling process to 
terminate; 

an act of a memory resident process detecting a termination event; 
an act of the memory resident process calling the termination function; and 
an act of executing the invalid instruction to provide termination information 
s„ related to the detected termination event, in response to the termination function 
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^ being called. 
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memory. 

3. The method as recited in claim 1, wherein the act of loading a termination 
function into system memory comprises an act loading termination function wherein the 
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temiination function is a terminate function, an abort function, an exit function, an _exit 
function, a _cexit function, a _c_exit function, an amsg_exit function, or an ExitProcess 
function. 
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i t S i J likelihood of being propagated to an operating system code layer comprises redirecting the 
termination function to a detour function that includes an instruction that attempts to write 



4. The method as recited in claim 1, wherein the act of loading a termination 
function into system memory comprises an act loading a termination function in response to 
user input. 

5. The method as recited in claim 1, wherein the act of redirecting the 
functionality of the termination function to a memory resident detour function comprises an 
act of activating in memory redirection. 

6. The method as recited in claim 1, wherein the act of redirecting the 
functionality of the termination function to a memory resident detour function comprises an 
act of redirecting the termination function to a detour function that can cause an exception 
having an increased likelihood of being propagated to an operating system code layer. 
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pii^>^Z 7. The method as recited in claim 6, wherein the act of redirecting the 

m ^ S 5 D termination function to a detour function that can cause an exception having an increased 



O data to memory address zero. 
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8. The method as recited in claim 6, wherein the act of redirecting the 
termination function to a detour function that can cause an exception having an increased 
likelihood of being propagated to an operating system code layer comprises redirecting the 
termination function to a detour function including an instruction that causes an access 
violation. 



9. The method as recited in claim 1, wherein the act of a memory resident 
process detecting a termination event comprises an act of memory resident process detecting 
a C+H- exception that was generated by the memory resident process, the C+H- exception 
being an exception that cannot be appropriately handled by a debugger. 



10. The method as recited in claim 1, wherein an act of executing the invalid 
instruction to provide termination information related to the detected termination comprises 
an act of generating an exception that has an increased chance of being propagated to an 
operating system code layer. 

[g 11. The method as recited in claim 1, wherein an act of executing the invalid 

^"si^^Z instruction to provide termination information related to the detected termination event 
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comprises executing an instruction that attempts to write data to memory address zero. 



12. The method as recited in claim 1, wherein an act of executing the invalid 



O instruction to provide termination information related to the detected termination event 

comprises an act of providing termination information wherein the termination is one or 
more of register values, a memory dump, and an event log. 
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13. The method as recited in claim 1, wherein an act of executing the invaUd 
instruction to provide termination information comprises an act of an exception catcher 
catching an xmhandled exception generated by the invalid instruction. 

14. The method as recited in claim 1, wherein an act of executing the invalid 
instruction to provide termination information comprises an act of invoking a debug process 
that gathers termination information. 

1 5. The method as recited in claim 1 , further comprising 

an act of activating in memory redirection in a system registry. 
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16. In a computer system including system memory, a method for providing 
information related to the termination of a process, the method comprising: 

a step for configuring a termination function to execute an invalid instruction 
that provides termination information associated with a termination event; 

an act of a memory resident process detecting a termination event; 

an act of the memory resident process calling the termination function; and 

an act of executing the invalid instruction to provide termination information 
related to the detected termination event, in response to the termination function 
being called. 

17. The method as recited in claim 16, wherein the step for configuring a 
termination function to execute an invalid instruction that provides termination information 
comprises a corresponding act of altering source code such that a termination event causes 
the invalid instruction to be executed. 



18. The method as recited in claim 16, wherein the step for configuring a 
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[2 termination function to execute an invalid instruction that provides termination information 

la:^ 5 ? ^ ^ ^ comprises a corresponding act of altering binary code such that a termination event causes 



S d > a D the invalid instruction to be executed. 
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19. The method as recited in claim 16, wherein the step for configuring a 



O termination function to execute an exception instruction that provides termination 

information comprises a corresponding act of redirecting a library such that a termination 
event causes the exception instruction to be executed. 

- Page 3 1 - Docket No. 13768.438 



20. The method as recited in claim 19, wherein the corresponding act of 
redirecting a library such that a termination event causes the invalid instruction to be 
executed comprises an act of redirecting a dynamic link library. 
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21 . A computer program product for use in a computer system including systeni 
memory, the computer program product for implementing a method for providing 
information related to the termination of a process, the computer program product 
comprising one or more computer-readable media having stored thereon computer 
executable instructions that, when executed by a processor, cause the computer system to 
perform the following: 

load a termination function into system memory, the termination function 
having termination instructions that, when executed, cause a calling process to 
terminate without providing information related to a termination event that caused 
the calling process to terminate; 

redirect the functionality of the termination function to a memory resident 
detour function such that when the termination function is called instructions of the 
detour function are executed, the detour function having an invalid instruction that, 
when executed, causes an exception that can provide termination information related 
to a termination event that caused a calling process to terminate; 
jh detect a termination event; 

^ call the termination function; and 
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22. The computer program product as recited in claim 21, wherein computer- 
executable instructions that, when executed, cause the computer system to load a 
termination function into system memory comprise computer-executable instructions that, 
when executed, cause the computer system to load a termination function wherein the 
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termination function is a terminate function, an abort function, an exit function, an _exit 
function, a cexit function, a _c_exit function, an _amsg_exit function, or an ExitProcess 
function. 



23. The computer program product as recited in claim 21, wherein computer- 
executable instructions that, when executed, cause the computer system to redirect the 
functionality of the termination function to a memory resident detour function comprise 
computer-executable instructions that, when executed, cause the computer system to execute 
a detour call in the termination function, the detour call calling the detour function. 



24. The computer program product as recited in claim 21, wherein computer- 
executable instructions that, when executed, cause the computer system to redirect the 
functionality of the termination function to a memory resident detour function comprise 
computer-executable instructions that, when executed, cause the computer system to redirect 
the functionality of the termination fimction to a memory resident detour function that 
K„ includes an instruction that attempts to write data to memory address zero. 
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p^S<^^E 25. The computer program product as recited in claim 21, wherein computer- 

S^>^op^' executable instructions that, when executed, cause the computer system to redirect the 

yi ^ O H W 

a t w 2 ^ functionality of the termination function to a memory resident detour function comprise 



computer-executable instructions that, when executed, cause the computer system to redirect 
the functionality of the termination function to a memory resident detour function including 
an instruction that causes an access violation. 
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26. The computer program product as recited in claim 21, wherein computer- 
executable instructions that, when executed, cause the computer system to execute the 
invalid instruction to provide termination information related to the detected termination 
event comprise computer-executable instructions, that when, executed cause the computer 
system to execute an instruction that causes an access violation. 



27. The computer program product as recited in claim 21, wherein computer- 
executable instructions that, when executed, cause the computer system to execute the 
invalid instruction to provide termination information related to the detected termination 
event comprise computer-executable instructions that, when executed, cause an exception 
having an increased chance of being propagated to an operating system code layer. 



28. The computer program product as recited in claim 21, wherein computer- 
executable instructions that, when executed, cause the computer system to execute the 
invalid instruction to provide termination information related to the detected termination 
^ event comprise computer-executable instructions, that when, executed cause the computer 

[2 system to provide termination information wherein the termination information is one or 

p^^<^^Z niore of register values, a memory dump, and an event log. 
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S^tl^^ 29. The computer program product as recited in claim 21, wherein computer- 

^ ^ executable instructions that, when executed, cause the computer system to execute the 

O invalid instruction to provide termination information related to the detected termination 

event comprise computer-executable instructions that, when executed, cause a debug 

process to gather termination information. 
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30. The computer program product as recited in claim 21, wherein the one or 
more computer-readable media comprise physical storage media. 
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